General

  • Target

    1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118

  • Size

    789KB

  • Sample

    240506-b1dk3ach5z

  • MD5

    1a26f946ac1d1a308989f533596d5b5d

  • SHA1

    a88e79bbdd4a3d47f47dd6c977bec9015e14c6b5

  • SHA256

    e5d8344ae7d9f2641a4e564d0e6e1a6494e216e6a5be0355eb45190e25d11f8f

  • SHA512

    ef7734f034793c582b30ed944c1ad91e42aef905bd84315f7ff44cc434cdb9635eb0e85d79e0f98181962faec55800b3c42a7881023f43a4f7323b4bd5746417

  • SSDEEP

    12288:icFUncJ54irus265GoqlDX1YH0COI+w7Ror6PpGg+l2K3RYUOPlNTXm1XBv1HfeO:2nYnuRcBIoGblBhGlBKvdfF

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

3nk4

Decoy

teresaanaya.com

byronhobbs.com

altiizgara.com

reignsponsibly.com

kanistones.com

clickpk.site

aizzainvestments.com

bpqbq.com

openfitxbstretch.com

blackvoicesstore.com

yousefzaid.com

verdeaccounting.com

independentthoughtshow.com

fainlywatchdog.com

elreventondelsabor.com

spiceyourfood.com

1277hb.com

cesttoni.com

portalngs.com

turismoplayas.com

Targets

    • Target

      1a26f946ac1d1a308989f533596d5b5d_JaffaCakes118

    • Size

      789KB

    • MD5

      1a26f946ac1d1a308989f533596d5b5d

    • SHA1

      a88e79bbdd4a3d47f47dd6c977bec9015e14c6b5

    • SHA256

      e5d8344ae7d9f2641a4e564d0e6e1a6494e216e6a5be0355eb45190e25d11f8f

    • SHA512

      ef7734f034793c582b30ed944c1ad91e42aef905bd84315f7ff44cc434cdb9635eb0e85d79e0f98181962faec55800b3c42a7881023f43a4f7323b4bd5746417

    • SSDEEP

      12288:icFUncJ54irus265GoqlDX1YH0COI+w7Ror6PpGg+l2K3RYUOPlNTXm1XBv1HfeO:2nYnuRcBIoGblBhGlBKvdfF

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

    • Formbook payload

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix

Tasks